Using authbind as an alternative may be preferable to setting capabilities. authbind is a system utility that allows users without superuser privileges to access privileged network services, including binding to privileged ports:

hobnob@hobnob:$ sudo apt install authbind

In contrast to setting capabilities, authbind allows more fine-grained control with regard to the port and permissions it is granting. Configuration files for authbind can be found at /etc/authbind. In short, if a user has permission to access the /etc/authbind/byport/<port> file, then that user is able to bind to that port:

hobnob@hobnob:$ sudo touch /etc/authbind/byport/80
hobnob@hobnob:$ sudo chown hobnob /etc/authbind/byport/80
hobnob@hobnob:$ sudo chmod 500 /etc/authbind/byport/80

Here, we are creating a configuration file for port 80, changing its owner to be the user running the API server, and setting its permission so that only hobnob can read it. Now, we can run our start script with authbind and it should work:

hobnob@hobnob:$ npx pm2 delete 0; authbind --deep yarn run serve